2 * Copyright (c) 2005 Marcel Moolenaar
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
32 #include <sys/param.h>
33 #include <sys/systm.h>
36 #include <sys/sysproto.h>
37 #include <sys/kernel.h>
41 #include <sys/mutex.h>
42 #include <sys/sched.h>
44 #include <sys/vmmeter.h>
45 #include <sys/sysent.h>
46 #include <sys/signalvar.h>
47 #include <sys/syscall.h>
48 #include <sys/pioctl.h>
49 #include <sys/ptrace.h>
50 #include <sys/sysctl.h>
52 #include <vm/vm_kern.h>
53 #include <vm/vm_page.h>
54 #include <vm/vm_map.h>
55 #include <vm/vm_extern.h>
56 #include <vm/vm_param.h>
57 #include <sys/ptrace.h>
58 #include <machine/cpu.h>
59 #include <machine/md_var.h>
60 #include <machine/reg.h>
61 #include <machine/pal.h>
62 #include <machine/fpu.h>
63 #include <machine/efi.h>
64 #include <machine/pcb.h>
66 #include <machine/smp.h>
69 #include <security/audit/audit.h>
71 #include <ia64/disasm/disasm.h>
73 static int print_usertrap = 0;
74 SYSCTL_INT(_machdep, OID_AUTO, print_usertrap,
75 CTLFLAG_RW, &print_usertrap, 0, "");
77 static void break_syscall(struct trapframe *tf);
80 * EFI-Provided FPSWA interface (Floating Point SoftWare Assist)
82 extern struct fpswa_iface *fpswa_iface;
84 static const char *ia64_vector_names[] = {
85 "VHPT Translation", /* 0 */
86 "Instruction TLB", /* 1 */
88 "Alternate Instruction TLB", /* 3 */
89 "Alternate Data TLB", /* 4 */
90 "Data Nested TLB", /* 5 */
91 "Instruction Key Miss", /* 6 */
92 "Data Key Miss", /* 7 */
94 "Instruction Access-Bit", /* 9 */
95 "Data Access-Bit", /* 10 */
96 "Break Instruction", /* 11 */
97 "External Interrupt", /* 12 */
98 "Reserved 13", /* 13 */
99 "Reserved 14", /* 14 */
100 "Reserved 15", /* 15 */
101 "Reserved 16", /* 16 */
102 "Reserved 17", /* 17 */
103 "Reserved 18", /* 18 */
104 "Reserved 19", /* 19 */
105 "Page Not Present", /* 20 */
106 "Key Permission", /* 21 */
107 "Instruction Access Rights", /* 22 */
108 "Data Access Rights", /* 23 */
109 "General Exception", /* 24 */
110 "Disabled FP-Register", /* 25 */
111 "NaT Consumption", /* 26 */
112 "Speculation", /* 27 */
113 "Reserved 28", /* 28 */
115 "Unaligned Reference", /* 30 */
116 "Unsupported Data Reference", /* 31 */
117 "Floating-point Fault", /* 32 */
118 "Floating-point Trap", /* 33 */
119 "Lower-Privilege Transfer Trap", /* 34 */
120 "Taken Branch Trap", /* 35 */
121 "Single Step Trap", /* 36 */
122 "Reserved 37", /* 37 */
123 "Reserved 38", /* 38 */
124 "Reserved 39", /* 39 */
125 "Reserved 40", /* 40 */
126 "Reserved 41", /* 41 */
127 "Reserved 42", /* 42 */
128 "Reserved 43", /* 43 */
129 "Reserved 44", /* 44 */
130 "IA-32 Exception", /* 45 */
131 "IA-32 Intercept", /* 46 */
132 "IA-32 Interrupt", /* 47 */
133 "Reserved 48", /* 48 */
134 "Reserved 49", /* 49 */
135 "Reserved 50", /* 50 */
136 "Reserved 51", /* 51 */
137 "Reserved 52", /* 52 */
138 "Reserved 53", /* 53 */
139 "Reserved 54", /* 54 */
140 "Reserved 55", /* 55 */
141 "Reserved 56", /* 56 */
142 "Reserved 57", /* 57 */
143 "Reserved 58", /* 58 */
144 "Reserved 59", /* 59 */
145 "Reserved 60", /* 60 */
146 "Reserved 61", /* 61 */
147 "Reserved 62", /* 62 */
148 "Reserved 63", /* 63 */
149 "Reserved 64", /* 64 */
150 "Reserved 65", /* 65 */
151 "Reserved 66", /* 66 */
152 "Reserved 67", /* 67 */
161 printbits(uint64_t mask, struct bitname *bn, int count)
166 for (i = 0; i < count; i++) {
168 * Handle fields wider than one bit.
170 bit = bn[i].mask & ~(bn[i].mask - 1);
171 if (bn[i].mask > bit) {
176 printf("%s=%ld", bn[i].name,
177 (mask & bn[i].mask) / bit);
178 } else if (mask & bit) {
183 printf("%s", bn[i].name);
188 struct bitname psr_bits[] = {
192 {IA64_PSR_MFL, "mfl"},
193 {IA64_PSR_MFH, "mfh"},
198 {IA64_PSR_DFL, "dfl"},
199 {IA64_PSR_DFH, "dfh"},
208 {IA64_PSR_CPL, "cpl"},
223 printpsr(uint64_t psr)
225 printbits(psr, psr_bits, sizeof(psr_bits)/sizeof(psr_bits[0]));
228 struct bitname isr_bits[] = {
229 {IA64_ISR_CODE, "code"},
230 {IA64_ISR_VECTOR, "vector"},
244 static void printisr(uint64_t isr)
246 printbits(isr, isr_bits, sizeof(isr_bits)/sizeof(isr_bits[0]));
250 printtrap(int vector, struct trapframe *tf, int isfatal, int user)
253 printf("%s %s trap (cpu %d):\n", isfatal? "fatal" : "handled",
254 user ? "user" : "kernel", PCPU_GET(cpuid));
256 printf(" trap vector = 0x%x (%s)\n",
257 vector, ia64_vector_names[vector]);
258 printf(" cr.iip = 0x%lx\n", tf->tf_special.iip);
259 printf(" cr.ipsr = 0x%lx (", tf->tf_special.psr);
260 printpsr(tf->tf_special.psr);
262 printf(" cr.isr = 0x%lx (", tf->tf_special.isr);
263 printisr(tf->tf_special.isr);
265 printf(" cr.ifa = 0x%lx\n", tf->tf_special.ifa);
266 if (tf->tf_special.psr & IA64_PSR_IS) {
267 printf(" ar.cflg = 0x%lx\n", ia64_get_cflg());
268 printf(" ar.csd = 0x%lx\n", ia64_get_csd());
269 printf(" ar.ssd = 0x%lx\n", ia64_get_ssd());
271 printf(" curthread = %p\n", curthread);
272 if (curthread != NULL)
273 printf(" pid = %d, comm = %s\n",
274 curthread->td_proc->p_pid, curthread->td_name);
279 * We got a trap caused by a break instruction and the immediate was 0.
280 * This indicates that we may have a break.b with some non-zero immediate.
281 * The break.b doesn't cause the immediate to be put in cr.iim. Hence,
282 * we need to disassemble the bundle and return the immediate found there.
283 * This may be a 0 value anyway. Return 0 for any error condition. This
284 * will result in a SIGILL, which is pretty much the best thing to do.
287 trap_decode_break(struct trapframe *tf)
289 struct asm_bundle bundle;
290 struct asm_inst *inst;
293 if (!asm_decode(tf->tf_special.iip, &bundle))
296 slot = ((tf->tf_special.psr & IA64_PSR_RI) == IA64_PSR_RI_0) ? 0 :
297 ((tf->tf_special.psr & IA64_PSR_RI) == IA64_PSR_RI_1) ? 1 : 2;
298 inst = bundle.b_inst + slot;
301 * Sanity checking: It must be a break instruction and the operand
302 * that has the break value must be an immediate.
304 if (inst->i_op != ASM_OP_BREAK ||
305 inst->i_oper[1].o_type != ASM_OPER_IMM)
308 return (inst->i_oper[1].o_value);
312 trap_panic(int vector, struct trapframe *tf)
315 printtrap(vector, tf, 1, TRAPF_USERMODE(tf));
317 kdb_trap(vector, 0, tf);
326 do_ast(struct trapframe *tf)
330 while (curthread->td_flags & (TDF_ASTPENDING|TDF_NEEDRESCHED)) {
336 * Keep interrupts disabled. We return r10 as a favor to the EPC
337 * syscall code so that it can quicky determine if the syscall
338 * needs to be restarted or not.
340 return (tf->tf_scratch.gr10);
344 * Trap is called from exception.s to handle most types of processor traps.
348 trap(int vector, struct trapframe *tf)
353 int error, sig, user;
356 user = TRAPF_USERMODE(tf) ? 1 : 0;
358 PCPU_INC(cnt.v_trap);
365 ia64_set_fpsr(IA64_FPSR_DEFAULT);
368 if (td->td_ucred != p->p_ucred)
369 cred_update_thread(td);
371 KASSERT(cold || td->td_ucred != NULL,
372 ("kernel trap doesn't have ucred"));
383 * This one is tricky. We should hardwire the VHPT, but
384 * don't at this time. I think we're mostly lucky that
385 * the VHPT is mapped.
387 trap_panic(vector, tf);
392 case IA64_VEC_EXT_INTR:
393 /* We never call trap() with these vectors. */
394 trap_panic(vector, tf);
397 case IA64_VEC_ALT_ITLB:
398 case IA64_VEC_ALT_DTLB:
400 * These should never happen, because regions 0-4 use the
401 * VHPT. If we get one of these it means we didn't program
402 * the region registers correctly.
404 trap_panic(vector, tf);
407 case IA64_VEC_NESTED_DTLB:
409 * When the nested TLB handler encounters an unexpected
410 * condition, it'll switch to the backup stack and transfer
411 * here. All we need to do is panic.
413 trap_panic(vector, tf);
416 case IA64_VEC_IKEY_MISS:
417 case IA64_VEC_DKEY_MISS:
418 case IA64_VEC_KEY_PERMISSION:
420 * We don't use protection keys, so we should never get
423 trap_panic(vector, tf);
426 case IA64_VEC_DIRTY_BIT:
427 case IA64_VEC_INST_ACCESS:
428 case IA64_VEC_DATA_ACCESS:
430 * We get here if we read or write to a page of which the
431 * PTE does not have the access bit or dirty bit set and
432 * we can not find the PTE in our datastructures. This
433 * either means we have a stale PTE in the TLB, or we lost
434 * the PTE in our datastructures.
436 trap_panic(vector, tf);
441 ucode = (int)tf->tf_special.ifa & 0x1FFFFF;
444 * A break.b doesn't cause the immediate to be
445 * stored in cr.iim (and saved in the TF in
446 * tf_special.ifa). We need to decode the
447 * instruction to find out what the immediate
448 * was. Note that if the break instruction
449 * didn't happen to be a break.b, but any
450 * other break with an immediate of 0, we
451 * will do unnecessary work to get the value
452 * we already had. Not an issue, because a
453 * break 0 is invalid.
455 ucode = trap_decode_break(tf);
457 if (ucode < 0x80000) {
458 /* Software interrupts. */
460 case 0: /* Unknown error. */
463 case 1: /* Integer divide by zero. */
467 case 2: /* Integer overflow. */
471 case 3: /* Range check/bounds check. */
475 case 6: /* Decimal overflow. */
476 case 7: /* Decimal divide by zero. */
477 case 8: /* Packed decimal error. */
478 case 9: /* Invalid ASCII digit. */
479 case 10: /* Invalid decimal digit. */
483 case 4: /* Null pointer dereference. */
484 case 5: /* Misaligned data. */
485 case 11: /* Paragraph stack overflow. */
492 } else if (ucode < 0x100000) {
493 /* Debugger breakpoint. */
494 tf->tf_special.psr &= ~IA64_PSR_SS;
496 } else if (ucode == 0x100000) {
498 return; /* do_ast() already called. */
499 } else if (ucode == 0x180000) {
502 error = copyin((void*)tf->tf_scratch.gr8,
505 set_mcontext(td, &mc);
506 return; /* Don't call do_ast()!!! */
509 ucode = tf->tf_scratch.gr8;
514 if (kdb_trap(vector, 0, tf))
518 trap_panic(vector, tf);
523 case IA64_VEC_PAGE_NOT_PRESENT:
524 case IA64_VEC_INST_ACCESS_RIGHTS:
525 case IA64_VEC_DATA_ACCESS_RIGHTS: {
533 va = trunc_page(tf->tf_special.ifa);
535 if (va >= VM_MAXUSER_ADDRESS) {
537 * Don't allow user-mode faults for kernel virtual
538 * addresses, including the gateway page.
544 vm = (p != NULL) ? p->p_vmspace : NULL;
550 if (tf->tf_special.isr & IA64_ISR_X)
551 ftype = VM_PROT_EXECUTE;
552 else if (tf->tf_special.isr & IA64_ISR_W)
553 ftype = VM_PROT_WRITE;
555 ftype = VM_PROT_READ;
557 if (map != kernel_map) {
559 * Keep swapout from messing with us during this
566 /* Fault in the user page: */
567 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
574 * Don't have to worry about process locking or
575 * stacks in the kernel.
577 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
580 if (rv == KERN_SUCCESS)
585 /* Check for copyin/copyout fault. */
586 if (td != NULL && td->td_pcb->pcb_onfault != 0) {
588 td->td_pcb->pcb_onfault;
589 tf->tf_special.psr &= ~IA64_PSR_RI;
590 td->td_pcb->pcb_onfault = 0;
593 trap_panic(vector, tf);
596 sig = (rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV;
600 case IA64_VEC_GENERAL_EXCEPTION: {
604 trap_panic(vector, tf);
606 code = tf->tf_special.isr & (IA64_ISR_CODE & 0xf0ull);
608 case 0x0: /* Illegal Operation Fault. */
609 sig = ia64_emulate(tf, td);
621 case IA64_VEC_SPECULATION:
623 * The branching behaviour of the chk instruction is not
624 * implemented by the processor. All we need to do is
625 * compute the target address of the branch and make sure
626 * that control is transfered to that address.
627 * We should do this in the IVT table and not by entring
630 tf->tf_special.iip += tf->tf_special.ifa << 4;
631 tf->tf_special.psr &= ~IA64_PSR_RI;
634 case IA64_VEC_NAT_CONSUMPTION:
635 case IA64_VEC_UNSUPP_DATA_REFERENCE:
640 trap_panic(vector, tf);
643 case IA64_VEC_DISABLED_FP: {
645 ia64_highfp_enable(td, tf);
647 trap_panic(vector, tf);
652 case IA64_VEC_SINGLE_STEP_TRAP:
653 tf->tf_special.psr &= ~IA64_PSR_SS;
656 if (kdb_trap(vector, 0, tf))
660 trap_panic(vector, tf);
666 case IA64_VEC_UNALIGNED_REFERENCE:
668 * If user-land, do whatever fixups, printing, and
669 * signalling is appropriate (based on system-wide
670 * and per-process unaligned-access-handling flags).
673 sig = unaligned_fixup(tf, td);
676 ucode = tf->tf_special.ifa; /* VA */
678 /* Check for copyin/copyout fault. */
679 if (td != NULL && td->td_pcb->pcb_onfault != 0) {
681 td->td_pcb->pcb_onfault;
682 tf->tf_special.psr &= ~IA64_PSR_RI;
683 td->td_pcb->pcb_onfault = 0;
686 trap_panic(vector, tf);
690 case IA64_VEC_FLOATING_POINT_FAULT:
691 case IA64_VEC_FLOATING_POINT_TRAP: {
692 struct fpswa_bundle bundle;
693 struct fpswa_fpctx fpctx;
694 struct fpswa_ret ret;
698 /* Always fatal in kernel. Should never happen. */
700 trap_panic(vector, tf);
702 if (fpswa_iface == NULL) {
708 ip = (char *)tf->tf_special.iip;
709 if (vector == IA64_VEC_FLOATING_POINT_TRAP &&
710 (tf->tf_special.psr & IA64_PSR_RI) == 0)
712 error = copyin(ip, &bundle, sizeof(bundle));
714 sig = SIGBUS; /* EFAULT, basically */
715 ucode = 0; /* exception summary */
719 /* f6-f15 are saved in exception_save */
720 fpctx.mask_low = 0xffc0; /* bits 6 - 15 */
722 fpctx.fp_low_preserved = NULL;
723 fpctx.fp_low_volatile = &tf->tf_scratch_fp.fr6;
724 fpctx.fp_high_preserved = NULL;
725 fpctx.fp_high_volatile = NULL;
727 fault = (vector == IA64_VEC_FLOATING_POINT_FAULT) ? 1 : 0;
730 * We have the high FP registers disabled while in the
731 * kernel. Enable them for the FPSWA handler only.
733 ia64_enable_highfp();
735 /* The docs are unclear. Is Fpswa reentrant? */
736 ret = fpswa_iface->if_fpswa(fault, &bundle,
737 &tf->tf_special.psr, &tf->tf_special.fpsr,
738 &tf->tf_special.isr, &tf->tf_special.pr,
739 &tf->tf_special.cfm, &fpctx);
741 ia64_disable_highfp();
744 * Update ipsr and iip to next instruction. We only
745 * have to do that for faults.
747 if (fault && (ret.status == 0 || (ret.status & 2))) {
750 ei = (tf->tf_special.isr >> 41) & 0x03;
751 if (ei == 0) { /* no template for this case */
752 tf->tf_special.psr &= ~IA64_ISR_EI;
753 tf->tf_special.psr |= IA64_ISR_EI_1;
754 } else if (ei == 1) { /* MFI or MFB */
755 tf->tf_special.psr &= ~IA64_ISR_EI;
756 tf->tf_special.psr |= IA64_ISR_EI_2;
757 } else if (ei == 2) { /* MMF */
758 tf->tf_special.psr &= ~IA64_ISR_EI;
759 tf->tf_special.iip += 0x10;
763 if (ret.status == 0) {
765 } else if (ret.status == -1) {
766 printf("FATAL: FPSWA err1 %lx, err2 %lx, err3 %lx\n",
767 ret.err1, ret.err2, ret.err3);
768 panic("fpswa fatal error on fp fault");
771 ucode = 0; /* XXX exception summary */
776 case IA64_VEC_LOWER_PRIVILEGE_TRANSFER:
778 * The lower-privilege transfer trap is used by the EPC
779 * syscall code to trigger re-entry into the kernel when the
780 * process should be single stepped. The problem is that
781 * there's no way to set single stepping directly without
782 * using the rfi instruction. So instead we enable the
783 * lower-privilege transfer trap and when we get here we
784 * know that the process is about to enter userland (and
785 * has already lowered its privilege).
786 * However, there's another gotcha. When the process has
787 * lowered it's privilege it's still running in the gateway
788 * page. If we enable single stepping, we'll be stepping
789 * the code in the gateway page. In and by itself this is
790 * not a problem, but it's an address debuggers won't know
791 * anything about. Hence, it can only cause confusion.
792 * We know that we need to branch to get out of the gateway
793 * page, so what we do here is enable the taken branch
794 * trap and just let the process continue. When we branch
795 * out of the gateway page we'll get back into the kernel
796 * and then we enable single stepping.
797 * Since this a rather round-about way of enabling single
798 * stepping, don't make things even more complicated by
799 * calling userret() and do_ast(). We do that later...
801 tf->tf_special.psr &= ~IA64_PSR_LP;
802 tf->tf_special.psr |= IA64_PSR_TB;
805 case IA64_VEC_TAKEN_BRANCH_TRAP:
807 * Don't assume there aren't any branches other than the
808 * branch that takes us out of the gateway page. Check the
809 * iip and enable single stepping only when it's an user
812 if (tf->tf_special.iip >= VM_MAXUSER_ADDRESS)
814 tf->tf_special.psr &= ~IA64_PSR_TB;
815 tf->tf_special.psr |= IA64_PSR_SS;
818 case IA64_VEC_IA32_EXCEPTION:
819 case IA64_VEC_IA32_INTERCEPT:
820 case IA64_VEC_IA32_INTERRUPT:
822 ucode = tf->tf_special.iip;
826 /* Reserved vectors get here. Should never happen of course. */
827 trap_panic(vector, tf);
831 KASSERT(sig != 0, ("foo"));
834 printtrap(vector, tf, 1, user);
838 ksi.ksi_code = ucode;
839 trapsignal(td, &ksi);
844 mtx_assert(&Giant, MA_NOTOWNED);
851 * Handle break instruction based system calls.
854 break_syscall(struct trapframe *tf)
860 /* Save address of break instruction. */
861 iip = tf->tf_special.iip;
862 psr = tf->tf_special.psr;
864 /* Advance to the next instruction. */
865 tf->tf_special.psr += IA64_PSR_RI_1;
866 if ((tf->tf_special.psr & IA64_PSR_RI) > IA64_PSR_RI_2) {
867 tf->tf_special.iip += 16;
868 tf->tf_special.psr &= ~IA64_PSR_RI;
872 * Copy the arguments on the register stack into the trapframe
873 * to avoid having interleaved NaT collections.
875 tfp = &tf->tf_scratch.gr16;
876 nargs = tf->tf_special.cfm & 0x7f;
877 bsp = (uint64_t*)(curthread->td_kstack + tf->tf_special.ndirty +
878 (tf->tf_special.bspstore & 0x1ffUL));
879 bsp -= (((uintptr_t)bsp & 0x1ff) < (nargs << 3)) ? (nargs + 1): nargs;
882 if (((uintptr_t)bsp & 0x1ff) == 0x1f8)
886 if (error == ERESTART) {
887 tf->tf_special.iip = iip;
888 tf->tf_special.psr = psr;
895 cpu_fetch_syscall_args(struct thread *td, struct syscall_args *sa)
898 struct trapframe *tf;
903 sa->code = tf->tf_scratch.gr15;
904 sa->args = &tf->tf_scratch.gr16;
907 * syscall() and __syscall() are handled the same on
908 * the ia64, as everything is 64-bit aligned, anyway.
910 if (sa->code == SYS_syscall || sa->code == SYS___syscall) {
912 * Code is first argument, followed by actual args.
914 sa->code = sa->args[0];
918 if (p->p_sysent->sv_mask)
919 sa->code &= p->p_sysent->sv_mask;
920 if (sa->code >= p->p_sysent->sv_size)
921 sa->callp = &p->p_sysent->sv_table[0];
923 sa->callp = &p->p_sysent->sv_table[sa->code];
924 sa->narg = sa->callp->sy_narg;
926 td->td_retval[0] = 0;
927 td->td_retval[1] = 0;
932 #include "../../kern/subr_syscall.c"
935 * Process a system call.
937 * See syscall.s for details as to how we get here. In order to support
938 * the ERESTART case, we return the error to our caller. They deal with
942 syscall(struct trapframe *tf)
944 struct syscall_args sa;
951 ia64_set_fpsr(IA64_FPSR_DEFAULT);
952 tf->tf_scratch.gr10 = EJUSTRETURN;
954 error = syscallenter(td, &sa);
955 syscallret(td, error, &sa);